Reviewed by Geoffrey Garen.
https://bugs.webkit.org/show_bug.cgi?id=34490
WebCore::ImageEventSender::dispatchPendingEvents() crashes in certain conditions
Test: fast/images/destroyed-image-load-event.html
* ForwardingHeaders/wtf/ValueCheck.h: Added.
* loader/ImageLoader.cpp:
(WTF::ValueCheck): Special case value check for ImageLoader - it's allocated inside elements,
so check the owner instead.
(WebCore::ImageEventSender::hasPendingEvents): Added a debugging aid for ImageLoader destructor.
(WebCore::ImageLoader::~ImageLoader): Assert that we're not going to leave dangling pointers
in ImageEventSender.
(WebCore::ImageLoader::setImage): Cancel events that could be dispatched for the previous
image. The only client using this method that I could find was DeleteButton, which doesn't
care about load events for the new image, so I didn't add any code for firing those.
(WebCore::ImageLoader::setLoadingImage): This method only existed to confuse readers -
there wasn't any meaningful code shared (callers just undid most assignments made there).
Merged the logic into callers.
(WebCore::ImageLoader::updateFromElement): We're forgetting the old image, so forget its
old events, too.
(WebCore::ImageLoader::notifyFinished): This can be called from setImage(), in which case
no one is going to dispatch the event "soon". So, don't queue it.
(WebCore::ImageEventSender::dispatchPendingEvents): Call checkConsistency(). This didn't
help catch this particuar bug, but seems like a useful check anyway.
* loader/ImageLoader.h: Removed setLoadingImage().
git-svn-id: http://svn.webkit.org/repository/webkit/trunk@54618 268f45cc-cd09-0410-ab3c-d52691b4dbfc
diff --git a/JavaScriptCore/wtf/ValueCheck.h b/JavaScriptCore/wtf/ValueCheck.h
new file mode 100644
index 0000000..2ab6925
--- /dev/null
+++ b/JavaScriptCore/wtf/ValueCheck.h
@@ -0,0 +1,64 @@
+/*
+ * Copyright (C) 2010 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ * notice, this list of conditions and the following disclaimer in the
+ * documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef ValueTraits_h
+#define ValueTraits_h
+
+// For malloc_size and _msize.
+#if OS(DARWIN)
+#include <malloc/malloc.h>
+#elif COMPILER(MSVC)
+#include <malloc.h>
+#endif
+
+namespace WTF {
+
+template<typename T> struct ValueCheck {
+ typedef T TraitType;
+ static void checkConsistency(const T&) { }
+};
+
+#if !ASSERT_DISABLED
+template<typename P> struct ValueCheck<P*> {
+ typedef P* TraitType;
+ static void checkConsistency(const P* p)
+ {
+ if (!p)
+ return;
+#if (defined(USE_SYSTEM_MALLOC) && USE_SYSTEM_MALLOC) || !defined(NDEBUG)
+#if OS(DARWIN)
+ ASSERT(malloc_size(p));
+#elif COMPILER(MSVC)
+ ASSERT(_msize(const_cast<P*>(p)));
+#endif
+#endif
+ ValueCheck<P>::checkConsistency(*p);
+ }
+};
+#endif
+
+}
+
+#endif // ValueTraits_h
